MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-22 23:07:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

upd: Add Worok TA and update APT-Q-12 to APT-C-60 as it was the first

Browse source 
name mention in an article.
This commit is contained in:
Thomas Dupuy 2023-07-18 19:53:54 +00:00
parent caceb504fe
commit 2dcd1d3544
1 changed files with 33 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
clusters/threat-actor.json
View file

@ -10560,14 +10560,18 @@
"value": "Void Balaur" "value": "Void Balaur"
}, },
{ {
"description": "APT-Q-12", "description": "APT-C-60",
"meta": { "meta": {
"refs": [ "refs": [
"https://mp.weixin.qq.com/s/Hzq4_tWmunDpKfHTlZNM-A" "https://mp.weixin.qq.com/s/Hzq4_tWmunDpKfHTlZNM-A",
"https://cert.360.cn/report/detail?id=6c9a1b56e4ceb84a8ab9e96044429adc"
],
"synonyms": [
"APT-Q-12"
] ]
}, },
"uuid": "6a83b2bf-0c51-4c9b-89b0-35df7cab1dd5", "uuid": "6a83b2bf-0c51-4c9b-89b0-35df7cab1dd5",
"value": "APT-Q-12" "value": "APT-C-60"
}, },
{ {
"description": "RomCom", "description": "RomCom",
@ -11410,7 +11414,32 @@
], ],
"uuid": "fceed509-938e-4f9e-acd4-76e6c28dc6f1", "uuid": "fceed509-938e-4f9e-acd4-76e6c28dc6f1",
"value": "RedDelta" "value": "RedDelta"
},
{
"description": "Worok is a cyber espionage group, mostly targeting Central Asia. The group toolset includes a C++ loader named CLRLoad, a PowerShell backdoor named PowHeartBeat, and a C# loader named PNGLoad.",
"meta": {
"attribution-confidence": "50",
"cfr-suspected-state-sponsor": "China",
"cfr-suspected-victims": [
"East Asia",
"Central Asia",
"Southeast Asia",
"The Middle East",
"Southern Africa"
],
"cfr-target-category": [
"Government",
"Energy Company"
],
"cfr-type-of-incident": "Espionage",
"country": "CN",
"refs": [
"https://www.welivesecurity.com/2022/09/06/worok-big-picture/"
]
},
"uuid": "77742419-aa71-4bc2-94c6-29c394b350e7",
"value": "Worok"
} }
], ],
"version": 275 "version": 276
} }